First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`TSwapPool::sellPoolTokens` Miscalculates Tokens Due to Incorrect Function Call.

passandscore

Summary

The sellPoolTokens function currently calls the swapExactOutput function, which is incorrect because it passes the poolTokenAmount as the parameter. Since poolTokenAmount specifies the amount of input tokens (pool tokens) the user wants to sell, the function should instead call swapExactInput. This mismatch leads to an incorrect calculation of the token amount received by the user, resulting in users getting incorrect token amounts.

Impact

Users will receive an incorrect amount of tokens due to the miscalculation, severely disrupting protocol functionality.

Tools Used

Manual Review

Recommendations

Consider implementing swapExactInput in place of swapExactOutput. This change requires modifying the sellPoolTokens function to include a new parameter, such as minWethToReceive, which will be passed to swapExactInput.

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint256 minWethToReceive,
) external returns (uint256 wethAmount) {
- return swapExactOutput(i_poolToken, i_wethToken, poolTokenAmount, uint64(block.timestamp));
+ return swapExactInput(i_poolToken, poolTokenAmount, i_wethToken, minWethToReceive, uint64(block.timestamp));
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.